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As part of its employee recruitment process, including considering your 
application for employment, C40 Cities Climate Leadership Group Inc. (C40), a 
Delaware incorporated, non-stock, non-profit corporation whose registered 
office is at 120 Park Avenue, Floor 23, New York, NY, USA, needs to collect, 
store and process your personal information. 


Please read the following carefully, before submitting your application, to 
understand how C40 treats your information when you apply for a position 
within our organisation. 


Please note that this Notice is reviewed from time to time and the current 
version will be posted on this website. 


1. Who we are 


Depending on the C40 office you apply to, the following may also be controllers 
of your personal information and it may be shared between these offices to 
achieve the purposes set out below: 


e If in the UK, C40 Cities Climate Leadership UK, a charity registered in 
England and Wales with company number 10401717 and charity 
number 1173124 whose registered office is at 3 Queen Victoria Street, 
London, EC4N 4TQ, UK. 


e If in South Africa, C40 Cities Climate Leadership South Africa NPC, a Non 
Profit Company registered in South Africa with a company number of 
2017/243962/08 whose registered office is at Traduna House, 118 
Jorissen Street, Braamfontein, 2001 Gauteng, South Africa. 


e If in Denmark, Foreningen C40 Cities Climate Leadership Denmark, an 
Association registered in Denmark with a CVR number of 40708243 
whose registered office is at c/o BLOXHUB, Bryghuspladsen 8, 1473 
Copenhagen K, Denmark. 


e Ifin China, C40 Cities Climate Leadership Group (USA) Beijing 
Representative Office, a Representative Office registered in China with 
unified social credit code G1110000MCW1706939 whose registered 
office is at Room 101, 10th floor, 124 Diplomatic Residence Compound, 
No.1 Xiushui Street, Chaoyang District, Beijing, China. 


Please note that, via a professional employment organization, such as 
SafeGuard World International (SGWI) or Shield GEO, in certain countries you 
may be employed by an ‘in-country employer’ which is a separate organization 
and will also be a data controller of your personal information. Your 
employment contract will make this clear. If you have any questions regarding 
this, please contact us. 


2. Personal information we collect 
Some examples of the types of personal information we process are: 


e Name, date of birth and other identity information (including any in 
documentation to prove identity) 

e address, telephone number, personal email address 

e nationality / visa / right to work information 

e employment history and references 

e pre-employment screening information including criminal history 
information 

e Any additional information provided to us directly by you throughout the 
application process 


During the recruitment process, we also collect some sensitive personal 
information about you — for example disability information, so that we can 
make reasonable adjustments where necessary for you to apply for a role, 
including interview access — to ensure we comply with legal and regulatory 
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obligations applicable to our hiring and employment practices. We may also 
collect diversity information about your race or ethnicity, religious beliefs, 
health and/ or sexual orientation in order to ensure meaningful equal 
opportunity monitoring and reporting. We ensure that this information is not 
used to make individual decisions about your recruitment. 


3. How we use personal information 


We collect and use your personal information for the following purposes 
(where applicable to the circumstances of your application): 


e To evaluate your application against the job listing and requirements and 
confirm your identity 

e Determine if you will be chosen for an interview or appointment 

e To manage and administer the recruitment and interview processes 

e If selected to fill the position, to collect from you the necessary information 
to perform a background check, which includes a criminal check and 
verification of work history provided during the evaluation process 

e To administer the onboarding process. 

e To comply with legal and regulatory requirements, and/ or to prevent or 
detect fraud (including providing your information to law enforcement 
agencies). 


Under applicable EU law, we are required to tell you our legal basis for 
processing your personal information. Our legal bases are generally: 


e In some cases, on the basis of your explicit consent 

e Onthe basis of our or your legitimate business interest in administering 
employment applications and recruitment (provided that interest is 
balanced against your rights and freedoms). 

e Tocomply with legal and regulatory obligations. 


4. How we keep your personal information secure 

When we handle your personal information, we do so through secured systems 
that employ appropriate technical measures and in accordance to strict 
internal HR specific information handling procedures. 

Access to Personal information collected is limited strictly to those who need to 
know to facilitate the recruitment process in accordance with this Privacy 


Notice. 


5. Sharing your personal information 
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We may need to share your personal information internally within the C40 
group (both in the country where you may work and in other countries in 
which we have central operations). In particular, our HR department is 
centralized in the UK. 


Your personal information is shared with those whom facilitate the activities 
listed in this Privacy Notice. This includes a number of third-party services, such 
as IT service providers. 


We only use such third-party services where they provide sufficient guarantees 
to safeguard your personal information. Where third-party services process 
your personal information, we put in place measures to ensure they do so only 
at C40’s direction and pursuant to an appropriate contract, and via the use of 
adequate technical measures. 


We may also need to share your personal information with certain external 
third parties including organisations that conduct background checks on our 
behalf, such as HireRight (https://www.hireright.com/), and where they 
provide a separate notice explaining this. 


6. Overseas processing 


C40 is an international organization and, as such, may need to transfer your 
information outside of your country. Some of these recipients will be located 
outside of the European Economic Area. In these scenarios, your information 
will only be transferred provided we have taken all steps reasonably necessary 
to ensure it receives an adequate level of protection (such as by entering into 
standardized clauses approved by relevant authorities). 


7. Retention Period 


If your application is un-successful, the personal information provided will 
generally be held for the period of 6 months (subject to applicable law) and 
then securely deleted. 


If your application is successful, your personal information will be stored for at 
least the period of your employment with C40 and for at least the minimum 
period set by the statutory or regulatory requirements applicable to your 
information and employment records. 


In general terms, C40’s overarching approach is that where no statutory or 
regulatory requirements exists, your personal information will be kept for the 
minimum period necessary for C40 to fulfil the purpose for which it was 
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collected. If you have any questions about our retention policies, please 
contact us at privacy@c40.org or write to us at ATTN: Legal Department, 120 
Park Ave, Floor 23, New York, NY 10017. 


8. Your Rights 


You have the right to request from us access to and rectification (if it is 
incorrect) of your personal information. 


Depending on where you are based or the office in which you are applying, you 
may also have the right to ask us to ‘restrict’ processing, object to processing in 
limited cases, as well as, in certain circumstances, the right to data portability 
or to erasure of your personal information. These are limited legal rights which 
may not apply in all circumstances. 


If you have provided consent for the processing of your information you have 
the right (in certain circumstances) to withdraw that consent at any time which 
will not affect the lawfulness of the processing before your consent was 
withdrawn. 


To exercise your rights, or for more information, please email privacy@c40.org. 
We may ask for further information from you or to verify your identity before 
we can comply with your requests. 


If you are an individual subject to the EU General Data Protection Regulation 
(broadly, this may be where you are based in the EU or you are applying for a 
role in one of C40’s offices based in the EU), you have the right to lodge a 
complaint to the Information Commissioners’ Office (in the UK), or the 
Supervisory Authority in your country, if you believe that we have not complied 
with the requirements of the GDPR with regards to your personal information. 


9. How to access personal information or if you have any other 
questions 


To request a copy of the personal information we hold about you, or if you 
have any other questions about this policy and the ways we use your personal 
information, please email privacy@c40.org or write to us at ATTN: Legal 
Department, 120 Park Ave, Floor 23, New York, NY 10017. 


